Hackers have compromised the official GitHub accounts of decentralised storage platform Swarm to distribute malicious software aimed at stealing cryptocurrency wallet keys.
Blockchain analytics firm SlowMist discovered the operation, warning that the malicious releases target Ethereum application developers across Windows, macOS, and Linux operating systems. The cybersecurity company specialises in smart contract audits and tracking cryptocurrency theft across blockchain networks.
According to the security researchers, attackers used the compromised Swarm accounts to publish infected software releases. Once installed on a computer, the software downloads and runs malicious JavaScript code that establishes communication with infrastructure controlled by the hackers.
Smart contracts used for command storage
The attackers used an Ethereum smart contract as a decentralised configuration storage system to manage their operations. In blockchain architecture, smart contracts are automated programs that execute directly on the network. Representatives from SlowMist explained that this setup allowed the unknown hackers to update their command server addresses remotely without having to publish new infected versions of the software. That capability made the illicit activity significantly harder for security teams to detect and block.
SlowMist analysts linked the smart contract directly to earlier malicious campaigns known as SleepyDuck and EtherDuck. Those previous operations targeted software developers through compromised extensions hosted on the Open VSX marketplace, an open registry for code editor tools. Blockchain security specialists stated that the technical architecture displays the distinct signature of the same threat group.
Swarm provides a peer-to-peer storage and communication network created to support decentralised applications within the Ethereum ecosystem, enabling users and services to store data without relying on central corporate servers. GitHub, a major web-based development platform owned by Microsoft, is used by millions of programmers worldwide to host software repositories, coordinate open-source development, and publish official code releases.
Recommended updates for affected versions
SlowMist has recommended that developers immediately delete all compromised versions of Swarm and install the verified clean release 13.2.0. Users of the Swarm Desktop application on version v0.56.2 have also been told to upgrade to safe version v0.56.3.
The exact number of victims and the total financial losses from the breach have not been established. However, analysts pointed out that compromising developer accounts demonstrates how hackers can obtain unauthorised entry into the wider Ethereum ecosystem, putting end users at direct risk of having their cryptocurrency assets stolen.
Earlier attacks on crypto platforms
The incident follows another recent discovery by SlowMist involving malware disguised as legitimate commercial software. Analysts at the firm recently uncovered an infected program circulating under the guise of a cracked version of TradingView Premium, a subscription tier for the popular financial market analysis platform.
That malicious file operated as an information stealer, harvesting confidential user data and extracting passwords from cryptocurrency wallets stored on compromised devices.
